Overview

overview

10

Static

static

3

f296876ebb...18.exe

windows7-x64

10

f296876ebb...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2024 15:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe

  • Size

    384KB

  • MD5

    f296876ebba9dbd1085b55b219b3e869

  • SHA1

    d9ddcb36580ccee4687b5efcb8c7d6a3bdbc7703

  • SHA256

    1506227b3ca0429e22ae401eed7eea7b7eedb4a50f80d496bfb0a93c50c13d5b

  • SHA512

    9b0942e8f993faf6d18689bab8ae368b2da5eedee1bee0acdfd5f9444bc15027d447fc8ae72989ee52f58771865907ece85d32a6a312b5a9c7fe70b4db0d0e4d

  • SSDEEP

    6144:HQMHIy84D4yxhkLAlsC+erjEU0R+f5DerHWQL1ZFGjg0AWO5rGMlukVt45yl07gc:HWF4D4YkE+ugTk6TQBABNKkVtEyl/

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+omtch.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E3116616D12D8F3 2. http://kkd47eh4hdjshb5t.angortra.at/E3116616D12D8F3 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/E3116616D12D8F3 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/E3116616D12D8F3 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E3116616D12D8F3 http://kkd47eh4hdjshb5t.angortra.at/E3116616D12D8F3 http://ytrest84y5i456hghadefdsd.pontogrot.com/E3116616D12D8F3 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/E3116616D12D8F3
URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/E3116616D12D8F3

http://kkd47eh4hdjshb5t.angortra.at/E3116616D12D8F3

http://ytrest84y5i456hghadefdsd.pontogrot.com/E3116616D12D8F3

http://xlowfznrg4wf7dli.ONION/E3116616D12D8F3

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (390) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\pslcspajovul.exe
        C:\Windows\pslcspajovul.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\pslcspajovul.exe
          C:\Windows\pslcspajovul.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2500
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:560
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:2580
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3068
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2692
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\PSLCSP~1.EXE
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1804
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\F29687~1.EXE
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2708
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+omtch.html
    Filesize

    9KB

    MD5

    3a29c9c9e8f75fead9c1114926557044

    SHA1

    aaa81b3b447cc8fcd33d7f41122091b2c9e7b560

    SHA256

    0a47103b55f10a07598180fe4ef6ed86fb4be2ee36f361e0256d36faea6c5614

    SHA512

    0818725bf5580de3428e88cb29dec4dec8ecd8a50fc7f6d56a16576d997e837fc3f17624ae57e69d1f4a9f9700821449c8e151553db53b39e03f91f965132575

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+omtch.png
    Filesize

    62KB

    MD5

    1b3fb302cddd8e989a03ff3dffe43957

    SHA1

    93e3a44ae168ba656cf09a2f15c20672eafd9e52

    SHA256

    2e21647929ed9275b7a5214acf661d06424c13372c945fffbe04049cacc73067

    SHA512

    1ad7924b4d808a785edb72c5c1cf5dda031288b76f9584a96c96feb9ed0671a038f87648dc2cb866e6f66426cb462d7f342916c9081b61f8b57e41ef28cef216

    Download Submit

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+omtch.txt
    Filesize

    1KB

    MD5

    ab238b3a04871d7fa9f8230dda57a9bf

    SHA1

    600949fab6002df48a80d643d8378f6a50fc3816

    SHA256

    00cbe4df59174d5c2dd82afd979f8e370424b76c2780b27791c6f5c414e73186

    SHA512

    3064a4cce5382609622526a2b8da1dfd1285d1bad420119e8162e641890ad230b7e6c3d0e482494e0a675de51a3525756e84653b7f604ff76b84f043b5e25f99

    Download Submit

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
    Filesize

    11KB

    MD5

    251c1a8747e145dcbff701c546433c8a

    SHA1

    43435c0244bab1492d58f06148955b64cc3165bb

    SHA256

    9968455053e0f47887045ac10a022cabfae9e61881257d0cdb113c3c3156ea50

    SHA512

    f9ea25382d47ee68c54c34416cabaee961235fc8d2b274267ae63ee566d3bd483559b1836d967d760c78a3698c2d41db4bab9439dc65070cd7ddcc3c6deda781

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
    Filesize

    109KB

    MD5

    b26f244824c32582b97107411c5811db

    SHA1

    1f55ed46ba0efd080ebdbc3a5705efab9923ae45

    SHA256

    e3cb0352ec284e21f46af6c92fcd8720881c47c0b00b4b9e19a94611469e8b47

    SHA512

    6203a29713b93a0a2858c1322638412285b4438df9c35cb2acb0c188d9e91d7e753509b4915a7626e78810266a3a51573e352aff46a3e83dbade3f35ae8f8b73

    Download Submit

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
    Filesize

    173KB

    MD5

    2c17baae94505296975a4cf4584cfc16

    SHA1

    7607664f2fa3cffd2fcdbb3d613595d912c7272f

    SHA256

    02085642886e1f5b346adfa398015fafed7e9f48197d7f37462c8c18c298d48b

    SHA512

    ba834df98bf8e4d4509f64a58a05901350b7cc1e21cc22b27a1645ca2611e55517fd3e6d2fe6a9feb7f1e486d422b5873c9f7de520b9db2202400ec5cebb613b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    06222c9681c4d0486c94dd95286b2c8f

    SHA1

    d24438d7ddabb0f325510abe794269958fbaea40

    SHA256

    a36efeb080298449bc36b849380acba8704432ef5df4c6094ef45533e7901480

    SHA512

    f11dd4609c7d2ddc495ea80924c0e7053b16488af6597c6868c8a589577a22ef879fe0cb83d628e4f378ce2892cbe575c2520d9546786e105e20fe61c63798eb

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a8eec817b5bf8369e7304bb4c4bd8204

    SHA1

    c5d8582b64a01d02c1ef5b457806829569ee221f

    SHA256

    b80f4272722ecccc18c237e33452efdc0817431e79c270e51cafcbed0a9d1613

    SHA512

    8be10dfdea4f90af7ddcae4b45e2f4328d18312b70e440b98e3792e7b09f706519bdc1983e1255b468b4b600802f35c3cf8256ec2bab6730875d5f736690469c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    de9b2adb4daf6654d7ffecb3436d1039

    SHA1

    ca7fbd5635d6cb97296b194bf786b653ec1d0299

    SHA256

    6cea4b6fe80085da6dd1ca92686dfbb0ab108542f44bc37d8d679b391f8f11d5

    SHA512

    96ba2671bdc56b7d0ba74af0ba39d812966672722372cfb3d3a742c0d762c9d64807cbd6887503448db86c9da722bacfeb6e969b6c061305181188aba63b74d9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    d74354c418c206a797be41ce4d4af436

    SHA1

    d9b1245160a9b687f397838d0ec04a027f69bf49

    SHA256

    7269ebdc08720031c28a8e88d4cd8bdda190f55ff924152cc2d72f87756d3e80

    SHA512

    063a17cb525df3eff338247d58e66cc828983dd4128bde4a8bb219e87ab6eca643d295da61c3aaebbeeaad02563b0d2e57a506583743672f7cd31a092bc50a40

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    786451e465952d917ceba237d3c5c3b2

    SHA1

    e59d83af732f8221f6a3043bde3988c05103aa5d

    SHA256

    d088b068bdd31dca110b47ce1bc74c3ed44bef9f0d49132619ad12ff7fe008bf

    SHA512

    5e24ccb7482932add82f456174fd7fafa0f56bafbf11a0a2ba318526801a3446a9b450c895ef0151f49144873dba78e04016174ea9b94da1abf73f9320b46879

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c4cd1fda221ea1696fff64bec47a9d75

    SHA1

    3eeddf5969c0b9f6d7b9042a4760cea10b2adb8b

    SHA256

    13e37e6c59192ee4c48dda957c18c07b11d64e318b387702693a1cf8353ac9f1

    SHA512

    eb7d494f1633df956e0a1735425c5c0e84f44b08044354752c2838b1f40bcfc5659303b76d9f4c634351e77bbdc126f72c39b13dccde834328874d9779b355bd

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    bf4d3a275a02d5f2918b0d6d34318f56

    SHA1

    5afbfe56146a8245d47eb685d16b36238b5fff58

    SHA256

    b0b57f27cde0364d3b4ed886558857cd22266ef3b40fbcee08dab0d2078e0792

    SHA512

    40a9f61731fdeea9888922f3f9e2c3c5b649ccf6c8f0cbc7fbbe8e61092ac2890f53950280a8e9d165d8520f00da662df50d4d9e1250823ce04e06ccf2f58027

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    960ffd17863f5a70471704c64c99a070

    SHA1

    d0a65d3f5c6709e8188c8ea34d50e8a0b0588409

    SHA256

    13de9e61eee057287d30456f7138cd74175feced854fa1bab35ce80327156ade

    SHA512

    1b53ee1a63cf32b5b235d7a38fcb9dda512b74b39635bd4434491015a3cf6f7810bcf8e7a5bb8c0e5af8437cc3cd6d0a8bddf1a02ab4e4b55004a552f14d3419

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    033919d8cec29713e76dbee77114b491

    SHA1

    fab9c6a38b2c7ce60de48bcf030ef56ddd670849

    SHA256

    361f9b5c72bd56ab2e54e98c26b9cc50613da920a19e39f4423563f648830f12

    SHA512

    6c2a7686497a17f2c6f4c9edca283fecae7687d7d47446a443864fafc0d6a5af9272991d6c45cab4d2074bbdadf2c2bbda728465a1c1435a868defb507b5cd3b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabF27B.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarF32B.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\pslcspajovul.exe
    Filesize

    384KB

    MD5

    f296876ebba9dbd1085b55b219b3e869

    SHA1

    d9ddcb36580ccee4687b5efcb8c7d6a3bdbc7703

    SHA256

    1506227b3ca0429e22ae401eed7eea7b7eedb4a50f80d496bfb0a93c50c13d5b

    SHA512

    9b0942e8f993faf6d18689bab8ae368b2da5eedee1bee0acdfd5f9444bc15027d447fc8ae72989ee52f58771865907ece85d32a6a312b5a9c7fe70b4db0d0e4d

    Download Submit

  • memory/1700-20-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-2-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-6-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-8-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-19-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-16-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-31-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1700-12-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-10-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/1700-4-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2108-30-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

    Download

  • memory/2292-0-0x00000000002F0000-0x00000000002F4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2292-18-0x00000000002F0000-0x00000000002F4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2292-1-0x00000000002F0000-0x00000000002F4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2500-1908-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-1906-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-5975-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-5981-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-5984-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-5079-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-5964-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-5973-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-1843-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-55-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-50-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-5970-0x0000000002BD0000-0x0000000002BD2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2500-51-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-52-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/2500-56-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

    Download

  • memory/3036-5971-0x0000000000120000-0x0000000000122000-memory.dmp

    Filesize

    8KB

    Download